[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Security Property Verification by Transition Model:

3.1.4. 3.1.4.

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management:

The authors wish to thank all individuals, organizations, and enterprises that contributed to the creation of this document. This includes Lisa Carnahan, Amy Mahn, Chris Enloe, Santi Kiran, Matt Scholl, and Kevin Stine of NIST; Matthew Smith and Daniel Topper of Huntington Ingalls Industries; Mat Heyman of Impresa Management Solutions. Organizations and individuals who provided feedback on the public comment drafts include: David Austin of Bible.org; Julie Chua, Linda Esah, Elizabeth Flaim, Kim Isaac, Nnake Nweke, Brent Roddy, Nicole Rohloff, and Musarat Qadri Shaikh of the Cyber-ERM Community of Interest; Melanie Tiano of CTIA; Frederick Doyle of CubicPrism Analytics, Inc.; Alicia Jones of Entergy Services, Inc.; Luke Bader of FAIR Institute; Bernice Harvey of Harvey Consulting & Training LLC; Janet Anderson of the National Security Agency, Kelly Hood and Tom Conkle of Optic Cyber Solutions; Amy Hamilton of the U.S. Department of Energy; the Executive Secretariat of the U.S. Department of Energy; and the U.S. Department of Health and Human Services Team; individual contributors include Louise Dandonneau and Carmen Estigarribia. - NISTIR 8286A (this report) provides additional detail regarding risk context, scenario identification, and analysis of likelihood and impact. It also includes methods to convey risk information, such as through cybersecurity risk registers (CSRRs) and risk detail records (RDRs). Similar processes, and the general use of risk registers, are helpful to identify and manage other types of risk, including those for Cyber Supply Chain and Privacy. - NISTIR 8286B describes ways to apply risk analysis to prioritize cybersecurity risk, evaluate and select appropriate risk response, and communicate risk activities as part of an enterprise CSRM strategy. - NISTIR 8286C describes processes for aggregating information from CSRM activities throughout the enterprise.

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Implementation of DevSecOps for a Microservices-based Application with Service Mesh provide?

[Assistant]
## NIST Special Publication 800-204C

## Implementation of DevSecOps for a Microservices-based Application with Service Mesh

Ramaswamy Chandramouli

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-204C

<!-- image -->

## NIST Special Publication 800-204C

## Implementation of DevSecOps for a Microservices-based Application with Service Mesh

Ramaswamy Chandramouli

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-204C

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

| versus RFID Systems ....................3-10                                                           |
| Table 4-1.
Factors Influencing Business Process                                                                                | Risk.............................................................4-2                                   |
| Table 4-2. Factors Influencing Business Intelligence                                                                                | Risk........................................................4-4                                        |
| Table 4-3. Factors Influencing Cyber Attack                                                                                | Risk.....................................................................4-8                           |
| Table 5-1. RFID Controls                                                                                | Summary........................................................................................5-26    |
| Table 6-1. OECD Basic Principles: Guidelines on the Protection of Privacy and Transborder Flows of Personal Data......................................................................................................6-4 |                                                                                |
| Table 6-2.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Metrics and Methodology for Hardware Security Constructs:

gineering, and physical security. CAPEC also analyzes the likelihood of such attacks being launched, their potential severity and flow of execution, and the skills that an adversary is likely to need.
| ID       | Description                                                           |
|----------|-----------------------------------------------------------------------|
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition   |
| CWE-1300 | Improper Protection of Physical Side Channels                         |
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC)      |
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State          |
| CWE-1191 | On-Chip Debug and Test Interface with Improper Access Control         |
| CWE-1231 | Improper Prevention of Lock Bit Modification                          |
| CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code      |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges          |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation          |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features      |

Metrics and Methodology for Hardware Security Constructs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach provide? (Part 5)

[Assistant]
he trustworthiness of systems with the capability to anticipate, withstand, recover from, and
adapt to adverse conditions, stresses, attacks, or compromises that use or are enabled by cyber
resources.
From a risk management perspective, cyber resiliency is intended to help reduce the
mission, business, organizational, enterprise, or sector risk of depending on cyber resources. This publication can be used in conjunction with ISO/IEC/IEEE 15288:2015, Systems and
software engineering—Systems life cycle processes; NIST Special Publication (SP) 800-160,
Volume 1, Systems Security Engineering—Considerations for a Multidisciplinary Approach in the
Engineering of Trustworthy Secure Systems; NIST SP 800-37, Risk Management Framework for
Information Systems and Organizations—A System Life Cycle Approach for Security and Privacy;
and NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations. It
can be viewed as a handbook for achieving the identified cyber resiliency outcomes based on a
systems engineering perspective on system life cycle and risk management processes, allowing
the experience and expertise of the implementing organization to help determine how the
content will be used for its purpose. Organizations can select, adapt, and use some or all of the
cyber resiliency constructs (i.e., goals, objectives, techniques, approaches, and design principles)
described in this publication and apply the constructs to the technical, operational, and threat
environments for which systems need to be engineered. KEYWORDS

Advanced persistent threat; controls; cyber resiliency; cyber resiliency approaches; cyber
resiliency design principles; cyber resiliency engineering framework; cyber resiliency goals; cyber
resiliency objectives; cyber resiliency techniques; risk management strategy; system life cycle;
systems security engineering; trustworthiness.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight:

|
| Appendix A. Change Log...................................................................................................................39         |
| List of Tables Table 1.
Examples of Cybersecurity Risk Normalization .......................................................................8       |

Notably, while the quote above is based on a U.S. Government directive, similar considerations for aggregate risk evaluation apply to private sector organizations. These include requirements from the U.S. Securities and Exchange Commission (SEC) 10  and core principles from the international Basel Committee on Banking Supervision. 11  Since exposure can affect investments, partner cooperation, credit lines, and other financial aspects, evaluation is critical for all types of enterprises.

Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Integrating Cybersecurity and Enterprise Risk Management (ERM):

o fully address targeted attacks, they represent a way to quickly identify some common vulnerabilities. However, cybersecurity weaknesses are not limited to the hardware and software of an enterprise.
Reviewing the NIST SP 800-53 controls immediately highlights the breadth of potential threats germane to cybersecurity, such as those that result from a lack of risk planning associated with Continuity of Operations (COOP), training, monitoring physical access, power considerations, and supply chain considerations.

Integrating Cybersecurity and Enterprise Risk Management (ERM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling of Consumer Software:

This  document  is not intended  to  describe  how  a  cybersecurity  label  should  be  explicitly represented (either physically or digitally) - nor is it intended to detail how a labeling program should be owned or operated.

Software is constantly being updated and modified. Likewise, a label may need  to  be  amended,  updated,  or  revoked.  Elapsed  time  between  the publishing  of  a  label  (especially  regarding  labels  printed  on  physical packaging) and receipt by the consumer may cause confusion concerning the status of the label's claims.

- Is available for consumers to view before and at the time and place of software selection as well as at a later time, as needed.
- Supports physical or digital formats as appropriate depending on the manner in which the software can be selected.
- The date (year at a minimum) when the label was asserted should be included on the label.
- The claimant is using a label that has undergone rigorous consumer testing to ensure its usability.

Recommended Criteria for Cybersecurity Labeling of Consumer Software


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

anization's own cybersecurity requirements. However, the variety of ways in which the Framework can be used by an organization means that phrases like 'compliance with the Framework' can be confusing.
|
| A new section on self- assessment                                                                                | Added Section 4.0 Self-Assessing Cybersecurity Risk with the Framework to explain how the Framework can be used by organizations to understand and assess their cybersecurity risk, including the use of measurements. |
| Greatly expanded explanation of using Framework for Cyber Supply Chain Risk Management purposes                             | An expanded Section 3.3 Communicating Cybersecurity Requirements with Stakeholders helps users better understand Cyber Supply Chain Risk Management (SCRM), while a new Section 3.4 Buying Decisions highlights use of the Framework in understanding risk associated with commercial off-the-shelf products and services. Additional Cyber SCRM criteria were added to the Implementation Tiers. Finally, a Supply Chain Risk Management Category, including multiple Subcategories, has been added to the Framework Core. |
| Refinements to better account for authentication, authorization, and identity proofing                                      | The language of the Access Control Category has been refined to better account for authentication, authorization, and identity proofing. This included adding one Subcategory each for Authentication and Identity Proofing. Also, the Category has been renamed to Identity Management and Access Control (PR.AC) to better represent the scope of the Category and corresponding Subcategories. |
| Better explanation of the relationship between Implementation Tiers and Profiles                                            | Added language to Section 3.2 Establishing or Improving a Cybersecurity Program on using Framework Tiers in Framework implementation.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Verification and Test Methods for Access Control Policies_Models:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

To address the issue, the AC Rule Logic Circuit Simulation (ACRLCS) technique [HS13], which enables the AC authors to detect a fault when the fault-causing AC rule is added to the model, so the  fixing  can  be  implemented  in  real  time  (on  the  spot)  before  adding  other  rules  that  further complicate the detecting effort. In other words, instead of checking by retracing the interrelations between rules after the policy is completed, the policy author needs only check the new added rule against previous 'correct' ones. In ACRLCS, AC rules are represented in a simulated logic circuit (SLC) (pronounced CELL-see). By simulation, it means ACRLCS is not necessarily implementable by a physical electronic circuit; however, the concept can be implemented and computed through simulated software.

Procedures and controls that limit or detect access to critical information resources. This can be accomplished through software, biometrics devices, or physical access to a controlled space.

Verification and Test Methods for Access Control Policies_Models


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to SRI International_ Improving the Security of Your UNIX System:

3.4.3       | The Is Command                       |   34 |
| 3. 3.4.3 The Is Command

Simple as its function is.

SRI International_ Improving the Security of Your UNIX System


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Analyzing Collusion Threats in the Semiconductor Supply Chain:

1. Concept: Concept stage is the birthplace of an Integrated Circuit (IC). At this stage, the goals and purpose of an integrated circuit (IC) are formulated, and the scope and target of a hardware component are discussed. Customers, the design, planning, finance teams, and other key stakeholders are involved at this stage. 2. Design: Design stage gives a form to the ideas generated in the concept stage. This is the stage where prototypes of the concept are created with the help of different Computer Aided Design (CAD) tools and analysis of whether the goals identified during the concept stage are met. This stage also includes the use of third-party software and hardware prototyping. 3. Integration: Integration is the stage where different design components from designers and third parties are integrated together. This phase is crucial since many design elements already have tested solutions, so not everything needs to be created from the ground up. It is more feasible to purchase these solutions from third parties and integrate them into the design. 4. Manufacturing: After the IC's design is finished, the manufacturing phase begins. This stage includes several processes, including fabrication and packaging. Due to the high cost of building and maintaining manufacturing facilities, many design houses are fabless and outsource their designs to manufacturers located elsewhere. 5. Testing: Testing is the stage at which manufactured Integrated Circuits (ICs) are tested to ensure that they perform properly. Following the completion of fabrication, each IC undergoes testing. An IC's functionalities are tested here to make sure they adhere to design specifications. 6. Provisioning: Provisioning is the stage where standard and sensitive data are loaded into the manufactured IC. Standard data are generic and mostly available open source, but the sensitive data are anything whose disclosure would compromise IP or security.

Analyzing Collusion Threats in the Semiconductor Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

gement, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.
| 1   | Introduction ............................................................................................................1   | Introduction ............................................................................................................1   |
|-----|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
|     | 1.1 Purpose                                                                                | .......................................................................................................... 1                 |
|     | 1.2 Scope.............................................................................................................. | 2                                                                                |
|     | 1.3 Previous Work                                                                                | ................................................................................................ 2                           |
|     | 1.4 Document Structure........................................................................................ | 2                                                                                |
|     | 1.5 Document Conventions...................................................................................

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories:

ll  NIST  documents  mentioned  in  this  publication,  other  than  the  ones  noted  above,  are available at http://csrc.nist.gov/publications. The authors, Kevin Stine, Rich Kissel, and William C.
Barker, wish to thank their colleagues, Jim Fahlsing and Jessica Gulick from Science Applications International Corporation (SAIC), who helped update this document, prepare drafts, and review materials. In addition, special thanks are due to our reviewers, Arnold Johnson (NIST), Karen Quigg (Mitre Corporation), and Ruth Bandler (Food and Drug Administration), who greatly contributed to the document's development. A special note of thanks goes to Elizabeth Lennon for her superb technical editing and administrative support. NIST also gratefully acknowledges and appreciates the many contributions from individuals in the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication.

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

Because each organization has unique security needs, security products have been applied on a case by case basis to meet individual security threats and concerns. Products should be flexible enough to serve a broad spectrum of security needs at the operating system level, the application level, the organizational level, and the site level. Organizational security requirements also change over time and cannot be totally specified at the time of product acquisition. This study has attempted to identify basic security needs of information technology product users, administrators, developers, and evaluators based on actual organizational practices.

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

- '... Through the process of risk management, leaders must consider risk to U.S. interests from adversaries using cyberspace to their advantage and from our own efforts to employ the global nature of cyberspace to achieve objectives in military, intelligence, and business operations... '
- ' ... For operational plans development, the combination of threats, vulnerabilities, and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess, coordinate, and deconflict all cyberspace operations... '
- ' ... Leaders at all levels are accountable for ensuring readiness and security to the same degree as in any other domain... '
- -- THE NATIONAL STRATEGY FOR CYBERSPACE OPERATIONS OFFICE OF THE CHAIRMAN, JOINT CHIEFS OF STAFF, U.S. DEPARTMENT OF DEFENSE

I nformation technology is widely recognized as the engine that drives the U.S. economy, giving industry a competitive advantage in global markets, enabling the federal government to provide better services to its citizens, and facilitating greater productivity as a nation. Organizations 5 in the public and private sectors depend on technology-intensive information systems 6 to successfully carry out their missions and business functions. Information systems can include diverse entities ranging from high-end supercomputers, workstations, personal computers, cellular telephones, and personal digital assistants to very specialized systems (e.g., weapons systems, telecommunications systems, industrial/process control systems, and environmental control systems).

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Usability and Security Considerations for Public Safety Mobile Authentication:

In the United States over 10 000 jurisdictions employ public safety personnel to respond to emergency situations every day. These first responders treat life-threatening injuries, deal with the consequences of natural disasters, fight crime, and combat terrorism. To perform these duties, emergency responders must undergo unique training, utilize specialized equipment, and access a variety of information systems. The use of specialized tools, information systems, and protective equipment places first responders within a unique environment to perform their jobs.

A variety of roles exist for LEOs, for example patrol officers, riot police, motorcycle patrol, detectives, highway patrol, sheriffs, and mounted policemen. Many of these roles exist at varying levels of government (i.e., federal, state, local, tribal). LEOs face threats from potentially malicious intelligent adversaries on a daily basis. LEOs receive specialized training and must operate in hostile environments requiring quick decision-making under high stress.

Passwords used for local authentication to a mobile device's lockscreen tend to be generated/managed by a user, and are shorter than passwords generated for remote authentication scenarios, since passwords for local authentication do not have to be resistant to the same set of threats. While there are many ways to measure the security of user generated passwords (e.g., [11], [17], [18]), the field of computer security lacks a universally agreed upon measurement standard with sufficient evidence to prove the merit of the standard. This method of authentication is vulnerable to shoulder surfing attacks.

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators:

3.1.4, a step was inserted that will provide backtracking resistance (step 14 of the pseudocode).

Recommendation for Random Number Generation Using Deterministic Random Bit Generators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

| Scope..............................................................................................................
| 2                                                                                |
|                                                                                | 1.2.1 Alternative Configurations                                                                                | ....................................................................3                                                        |
| 1.3                                                                                | Document Conventions................................................................................... | 3                                                                                |
| 2 TLS Overview .........................................................................................................4    | 2 TLS Overview .........................................................................................................4    | 2 TLS Overview .........................................................................................................4    |
| 2.1                                                                                | TLS Subprotocols                                                                                | ...........................................................................................

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

reas span those that are common to the entire IT infrastructure, such as physical security, authentication and authorization, change management, configuration control, incident response, and recovery.
Within these areas, security controls that are specific to storage technologies, such as network-attached storage (NAS) and storage area networks (SAN), are also covered. In addition, security recommendations specific to storage technologies are provided for the following areas of operation in the storage infrastructure:

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

4. Testing . Monitoring or auditing mode, available in most whitelisting technologies, allows software managers to estimate the impact on resources before enforcing whitelisting. Monitoring allows planning for resource requirements in advance of actual implementation.
5. Attributes . Increasingly, organizations are implementing whitelisting products that support more granular whitelisting attributes, such as Software Identification (SWID) tags. 11 In the Guide to Application Whitelisting (2015), the authors note:

Table 8: Low Baseline Control (Item) Allocation Table, Table 9: Moderate Baseline Control (Item) Allocation Table, and Table 10: High Baseline Control (Item) Allocation Table, provide the low, moderate, and high baseline control allocations, respectively. The following is a summary of the material in the security plan assessment narrative for each determination statement in Section 3.3. It provides a concise summary of the assessment plan.

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

3.1.2. 3.1.2.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.2.2. 3.2.2.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

| 1. Introduction.....................................................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.4.1. Enterprise Risk Management and C-SCRM Owners and Operators.............................................5                                         |
| 1.4.2. Enterprise, Agency, and Mission and Business Process Owners and Operators .........................5                                             |
| 1.4.3. Acquisition and Procurement Owners and Operators.................................................................6                               |
| 1.4.4. Information Security, Privacy, or Cybersecurity Operators .........................................................6                             |
| 1.4.5. System Development, System Engineering, and System Implementation Personnel.................7                                                    |
| 1.5.1. Enterprise's Supply Chain.............................................................................................................9          |
| 1.5.2. Supplier Relationships Within Enterprises .................................................................................10                    |
| 2. Integration of C-SCRM Into Enterprise-Wide Risk Management...................................................... 18                                  |
| 2.3.1. Roles and Responsibilities Across the Three Levels ...................................................................24                         |
| 2.3.2. Level 1 -Enterprise...................................................................................................................27         |
| 2.3.3.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

6. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations , SP 800-161 Rev. 1 [SP800-161r1]
7. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities , SP 800-218 [SSDF]
8. Information technology -Security techniques -Vulnerability disclosure processes , ISO/IEC 29147 [ISO29147]
9. Information technology -Security techniques -Vulnerability handling , ISO/IEC 30111 [ISO30111]
10. Risk management -Guidelines , ISO 31000 [ISO31000]
11. Systems and software engineering -Design and development of information for users , ISO/IEC/IEEE 26514 [ISO26514]

[WHAnnouncement] White House (2023) BidenHarris Administration Announces Cybersecurity Labeling Program for Smart Devices to Protect American Consumers. (White House, Washington, DC). https://www.whitehouse.gov/briefing-room/statementsreleases/2023/07/18/biden-harris-administration-announces-cybersecurity-labelingprogram-for-smart-devices-to-protect-american-consumers/ [IR8425] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core Baseline for Consumer IoT Products. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425. https://doi.org/10.6028/NIST.IR.8425 [BBF] Walls, J, Editor (2022) Functional Requirements for Broadband Residential Gateway Devices. (Broadband Forum, Fremont, CA), Technical Report (TR) 124, Issue 8. https://www.broadband-forum.org/pdfs/tr-124-8-0-0.pdf [CableLabs] CableLabs Security (2021) Gateway Device Security Best Common Practices. (CableLabs, Louisville, CO), CL-GL-GDS-BCP-V01-211007. https://community.cablelabs.com/wiki/plugins/servlet/cablelabs/alfresco/download?id=1 209eea3-bd81-40cb-9a18-21bd6cfcd80d [BSI] Federal Office for Information Security (2023) Secure Broadband Router: Requirements for Secure Broadband Routers.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide for Cybersecurity Event Recovery:

Introduction .........................................................................................................................1 | | | | 1.1 | Background.................................................................................................................1 | | | | 1.2 | Purpose and Scope | ....................................................................................................2 | | | 1.3 | Audience.....................................................................................................................2 | | | | 1.4 | Document Structure....................................................................................................3 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Considerations for Voice Over IP Systems provide? (Part 4)

[Assistant] | |----------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 Introduction ......................................................................................................................................10 | 1 Introduction ......................................................................................................................................10 | 1 Introduction ......................................................................................................................................10 | | 1.1 | Authority | ....................................................................................................................................10 | | 1.2 | Document Scope and Purpose ..................................................................................................10 | | | 1.3 | Audience and Assumptions.......................................................................................................11 | | | 1.4 | Document Organization ............................................................................................................11 | | | 2 Overview of VOIP............................................................................................................................13 | 2 Overview of VOIP............................................................................................................................13 | 2 Overview of VOIP............................................................................................................................13 | | .......................................................................................................................13 | .......................................................................................................................13 | .......................................................................................................................13 | | 2.1 | VOIP Equipment | | | 2.2 | Overview of VOIP Data Handling ...........................................................................................14 | | | 2.3 | Cost.............................................................................................................................................16 | | | 2.4 | Speed and Quality......................................................................................................................16 | | | 2.5 | Privacy and Legal Issues with VOIP........................................................................................17 | | | 2.6 | VOIP Security Issues.................................................................................................................17 | | | 3 Quality of Service Issues..................................................................................................................19 | 3 Quality of Service Issues..................................................................................................................19 | 3 Quality of Service Issues..................................................................................................................19 | | 3.1 | Latency.......................................................................................................................................19 | | | 3.2 | Jitter ............................................................................................................................................20 | | | 3.3 | Packet Loss | ................................................................................................................................21 | | 3.4 | Bandwidth &Effective Bandwidth ..........................................................................................22 | | | 3.5 | The Need for Speed...................................................................................................................24 | | | 3.6 | Power Failure and Backup Systems .........................................................................................24 | | | 3.7 | Quality of Service Implications for Security............................................................................25

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Computer Security Log Management:

rusion prevention systems record detailed information on suspicious behavior and detected attacks, as well as any actions intrusion prevention systems performed to stop malicious activity in progress.
Some intrusion detection systems, such as file integrity checking software, run periodically instead of continuously, so they generate log entries in batches instead of on an ongoing basis. 4
- GLYPH<c=31,font=/APONEK+Webdings> Remote Access Software. Remote access is often granted and secured through virtual private networking (VPN). VPN systems typically log successful and failed login attempts, as well as the dates and times each user connected and disconnected, and the amount of data sent and received in each user session. VPN systems that support granular access control, such as many Secure Sockets Layer (SSL) VPNs, may log detailed information about the use of resources. - GLYPH<c=31,font=/APONEK+Webdings> Web Proxies. Web proxies are intermediate hosts through which Web sites are accessed. Web proxies make Web page requests on behalf of users, and they cache copies of retrieved Web pages to make additional accesses to those pages more efficient. Web proxies can also be used to restrict Web access and to add a layer of protection between Web clients and Web servers. Web proxies often keep a record of all URLs accessed through them. - GLYPH<c=31,font=/APONEK+Webdings> Vulnerability Management Software. Vulnerability management software, which includes patch management software and vulnerability assessment software, typically logs the patch installation history and vulnerability status of each host, which includes known vulnerabilities and missing software updates. 5 Vulnerability management software may also record additional information about hosts' configurations. Vulnerability management software typically runs occasionally, not continuously, and is likely to generate large batches of log entries.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Directions in Security Metrics Research:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.    ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analysis to advance the development  and  productive  use  of  information  technology.    ITL's  responsibilities  include  the development of technical, physical, administrative, and management standards and guidelines for the  cost-effective  security  and  privacy  of  sensitive  unclassified  information  in  Federal  computer systems.    This  Interagency  Report  discusses  ITL's  research,  guidance,  and  outreach  efforts  in computer  security,  and  its  collaborative  activities  with  industry,  government,  and  academic organizations.

More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science.  During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees of success.  This paper provides an overview of the security metrics area and looks at possible avenues of research that could be pursued to advance the state of the art.

'At a high-level, metrics are quantifiable measurements of some aspect of a system or enterprise. For an entity (system, product, or other) for which security is a meaningful concept, there are some identifiable attributes that collectively characterize the security of that entity. Further, a security metric (or combination of security metrics) is a quantitative measure of how much of that attribute the entity possesses. A security metric can be built from lower-level physical measures.' [ISS08]


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide for Conducting Risk Assessments:

rganizations 5 in the public and private sectors depend on information technology 6 and information systems 7 to successfully carry out their missions and business functions. Information systems can include very diverse entities ranging from office networks, financial and personnel systems to very specialized systems (e.g., industrial/process control systems, weapons systems, telecommunications systems, and environmental control systems). Information systems are subject to serious threats that can have adverse effects on organizational operations and assets, individuals, other organizations, and the Nation by exploiting both known and unknown vulnerabilities to compromise the confidentiality, integrity, or availability of the information being processed, stored, or transmitted by those systems. Threats to information systems can include purposeful attacks, environmental disruptions, human/machine errors, and structural failures, and can result in harm to the national and economic security interests of the United States. Therefore, it is imperative that leaders and managers at all levels understand their responsibilities and are held accountable for managing information security risk-that is, the risk associated with the operation and use of information systems that support the missions and business functions of their organizations. O

Risk assessment is a key component of a holistic, organization-wide risk management process as defined in NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View . Risk management processes include: (i) framing risk; (ii) assessing risk; (iii) responding to risk; and (iv) monitoring risk. Figure 1 illustrates the four steps in the risk management process-including the risk assessment step and the information and communications flows necessary to make the process work effectively.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium:

-  Mandatory scanning (enumeration) of system prior to deploying to the network and disable all unneeded communications/system processes,
-  Review of user accounts/groups on the system including their level of privilege and adjust accordingly,
-  Removal of all unneeded applications installed on the system (browsers, readers, games, etc.),
-  Enable host based firewall to allow communication via secure ports to know IP addresses for manufacturer communications (disable this connectivity when not in use)
-  Processes developed for system updates/upgrades

-  Altering data to change specs of finish products
-  Availability
-  Components in sensitive applications may have unintended / undesirable performance characteristics that are undetectable
-  Confidentiality
-  Corruption of imbedded software @ machine
-  Corruption of STL files
-  Damage of manufacturing equipment
-  Design tools vulnerability -> CAD & pre-cad part of
-  Detection of inherent flaw - pilphereal IP is analyzed for existing flaw
-  Ensure the small & medium enterprise have the tools are reasonable price point
-  EtherCat or Industrial IP security? -  Getting tools to the right level capability at right price / affordable
-  Government entities each seem to have their own program for cyber security. The risk is two-fold: (1) they are talking, but not WORKING together. Wasting resources and efforts (2) Government is way behind industry, and not bringing them in to address this substantial gap
-  Integrity
-  IT/OT convergence --> how do I secure this… …
-  IVV of file transport from central storage to production facility
-  Modification of model
-  OEMs not ensuring security (& keeping backdoors open for "maintenance")
-  Tainted products (additional functionality)
-  The human aspect (social engineering)
-  Theft of intell property
-  Theft of IP
-  Treats to RF specturm - wireless is increasing the comms component of choice on factory floor.

Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

| Practice | Task | Priority | Recommendations [R], Considerations [C], and Notes [N] Specific to AI Model Development | Informative References | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

....................................................................... 11
2.4   SECURITY AND PRIVACY CONTROLS .........................................................................................
13
2.5   TRUSTWORTHINESS AND ASSURANCE ..................................................................................... 14
CHAPTER THREE   THE CONTROLS ................................................................................................. 16
3.1   ACCESS CONTROL .................................................................................................................. 18
3.2   AWARENESS AND TRAINING ................................................................................................... 59
3.3   AUDIT AND ACCOUNTABILITY ................................................................................................. 65
3.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 83
3.5   CONFIGURATION MANAGEMENT ........................................................................................... 96
3.6   CONTINGENCY PLANNING .................................................................................................... 115
3.7   IDENTIFICATION AND AUTHENTICATION ............................................................................... 131
3.8   INCIDENT RESPONSE ............................................................................................................ 149
3.9   MAINTENANCE .................................................................................................................... 162
3.10   MEDIA PROTECTION .......................................................................................................... 171
3.11   PHYSICAL AND ENVIRONMENTAL PROTECTION ....................................................................

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

3.3.3 Low Baseline Security Control Item Narratives ... 3.3.3). 3.3.3 )   | (2) Moderate Control Items ( Section 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

ives), there need to be different tiers of metrics based on the audience or user. For example, the CWE structure could be used to define security requirements that lead to associated security metrics.
Jason noted that CWEs for hardware are relatively new, starting around 2020, compared to CWEs' long track record for software, which started around 2006. Since CWEs point out common root cause weaknesses that lead to vulnerabilities, they foster a more proactive approach by allowing security issues to be discovered and mitigated earlier in the hardware development life cycle, thus lowering the financial impact. Having good metrics that can be used to inform design and business decisions would be helpful to the semiconductor community. Finally, Mark Tehranipoor from the University of Florida emphasized the importance of thinking about security and associated metrics in the early stages of the hardware development life cycle. Specifically, this involves conducting a security and risk assessment and developing a

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendation for Existing Application-Specific Key Derivation Functions:

Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Module Validation Program (CMVP) and the Cryptographic Algorithm Validation Program (CAVP). The requirements of this Recommendation are indicated by the word ' shall .' Some of these requirements may be out-of-scope for CMVP or CAVP validation testing, and thus are the responsibility of entities using, implementing, installing or configuring applications that incorporate this Recommendation.

Recommendation for Existing Application-Specific Key Derivation Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process:

System characteristics can be analyzed by reviewing its domain and goals, such as determining whether a system domain is in the area of communication, learning, planning, reasoning, or providing a service. Overall AI goals can then be identified, such as language processing, computer vision, deep learning, data science, or machine learning. This analysis informs the next phase of determining operational characteristics. For example, if a goal of a CAIS is to operate autonomously, the proxy must also be the same type of autonomous system.

|                    | Phy. Op. Envmt.   | AI App. Purpose                         | Operational Charac.                  | Dev. Algorithm   | Dev. Tech.   |
|--------------------|-------------------|-----------------------------------------|--------------------------------------|------------------|--------------|
| Autonomous Vehicle | Land              | Reasoning, learning, planning, services | O1:1; 02: 11111; O3: 0; O4: 9; 05: 9 | KMP Algorithm    | Java         |

|                  | Phy. Op. Envmt.   | AI App. Purpose                         | Operational Charac.                  | Dev. Algorithm   | Dev. Tech.   |
|------------------|-------------------|-----------------------------------------|--------------------------------------|------------------|--------------|
| RobotWeed Killer | Land              | Reasoning, learning, planning, services | O1:1; 02: 11111; O3: 0; O4: 0; 05: 9 | KMP Algorithm    | Java         |
| RobotVacuum      | Land              | Reasoning, learning, planning, services | O1:1; 02: 11111; O3: 0; O4: 0; 05: 9 | KMP Algorithm    | Java         |

Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results:

Today, Blue Cross of California interacts with the United States government in health care as a Medicare processor. We have also bid on the contract to become the CHAMPUS processor in California and Hawaii. (As you may know, CHAMPUS is the program to provide medical coverage to dependents of military personnel.) These interactions are different from traditional claims processing that starts with the provider and ends with the payer. With Medicare and CHAMPUS, the electronic path of a claim continues on to the HCFA or DoD agency. I thought it would be interesting to look at some of the information requirements of those two agencies as an example ofthe public-private data exchange partnership now in place.

access control: this attribute is designed to prevent the use of the system by unauthorized personnel or in an unauthorized manner. A company would not want its telecommunication system to be tapped into and used to order and reroute merchandise or other assets to some enterprising hacker.

Access control; This attribute is designed to prevent the use of the system by unauthorized personnel or in an unauthorized manner.

Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Application Whitelisting:

An application whitelist is a list of applications and application components that are authorized for use in an organization. Application whitelisting technologies use whitelists to control which applications are permitted to execute on a host. This helps to stop the execution of malware, unlicensed software, and other unauthorized software. This publication is intended to assist organizations in understanding the basics of application whitelisting. It also explains planning and implementation for whitelisting technologies throughout the security deployment lifecycle. An application whitelist is a list of applications and application components (libraries, configuration files, etc.) that are authorized to be present or active on a host according to a well-defined baseline. The technologies used to apply application whitelists-to control which applications are permitted to install or execute on a host-are called whitelisting programs , application control programs, or application whitelisting technologies . Application whitelisting technologies are intended to stop the execution of malware and other unauthorized software. Unlike security technologies such as antivirus software, which block known bad activity and permit all other, application whitelisting technologies are designed to permit known good activity and block all other. The purpose of this publication is to assist organizations in understanding the basics of application whitelisting and planning for its implementation. An application whitelist is a list of applications and application components (libraries, configuration files, etc.) that are authorized to be present or active on a host according to a well-defined baseline. The technologies used to enforce application whitelists-to control which applications are permitted to be installed or executed on a host-are called whitelisting programs , application control programs, or application whitelisting technologies .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

| | Introduction .........................................................................................................................1 | Introduction .........................................................................................................................1 | |---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| | | Purpose.........................................................................................................................2 | | | | Scope............................................................................................................................2 | | | | Audience | .......................................................................................................................4 | | Intended Use........................................................................................................................5 | Intended Use........................................................................................................................5 | | | | EV/XFC Cybersecurity Mission Objectives.......................................................................5 | EV/XFC Cybersecurity Mission Objectives.......................................................................5 | | | Mission Objective 1: Deliver Reliable Performance through Secure Communications.6 | | | | Mission Objective 2: Maintain Resilience of the XFC Infrastructure..............................7 | | | | Mission Objective 3: Build and Maintain Trustworthy Relationships with Partners and Customers..............................................................................................................7 | | | | Mission Objective 4: Maintain Continuity of Operations................................................8 | | | | Overview of the Cybersecurity Framework ......................................................................8 | | | | The Framework Core ....................................................................................................9 | | | | Sector-Level Profiles | ...................................................................................................12 | | | XFC Baseline Profile .........................................................................................................12 | | | | Identify Function..........................................................................................................12 | | | 5.1.1.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Three Variants of Ciphertext Stealing for CBC Mode:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement  and  standards  infrastructure.  ITL  develops  tests,  test  methods,  reference  data,  proof  of concept  implementations,  and  technical  analyses  to  advance  the  development  and  productive  use  of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems.  This  Special  Publication  800-series reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations.

Recommendation for Block Cipher Modes of Operation_ Three Variants of Ciphertext Stealing for CBC Mode


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Quick Start Guide for Populating Mobile Test Devices:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

Quick Start Guide for Populating Mobile Test Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

probably need to be taken offline for maintenance at various times and therefore two-way communication in advance among the community members is essential to achieving a clear understanding of the service levels that they offer to one another and require from one another. Generally, for outsourced or public SaaS clouds, consumers need not become involved with the management of a provider's infrastructure. For example, consumers need not be distracted by which operating system, hardware devices or configuration choices, or software library versions underlie a SaaS application. In particular, providers have responsibility for operational issues such as backups, system maintenance, security patches, power management, hardware refresh, physical plant security, etc. Providers also have an obligation to field services that guard against known exploits at the application level. Further, consumers are not required to maintain on premises IT support to perform these tasks, with

As illustrated in Figure 17, the operation of an IaaS cloud is a cyclical process of consumer requests flowing in and down through the hierarchy, and responses flowing back up to consumers. In addition to virtual machine operations, consumers may directly access data storage servers in the cloud. Even though the aggregate consumer demand peaks and troughs should be more gradual than individual consumer demand peaks and troughs, the cloud will sometimes be underutilized and migration of consumer workloads from computer system to computer system, or even from cluster to cluster, is a strategy that can concentrate consumer workloads on a set of highly utilized machines and allow others to be turned off to save some of the costs of their operation or to allow maintenance activities to be performed.

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Attribute Considerations for Access Control Systems:

3.5.1                                                                                | Group Attribute Use Metadata... 3.5.1 Group Attribute Use Metadata

In  the  course  of  managing  attributes,  metadata  is  applied  to  subjects  and  objects  as  extended attribute  information  useful  for  enforcing  fine-grained  access  control  policies  that  incorporate information about the attributes and manage the volumes of data required for enterprise attribute management.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Computer Security Division 2010 Annual Report:

In fiscal year (FY) 2010, CSD continued to build on its work in se curity management and assurance, cryptography and systems se curity, identity management and emerging security technologies. CSD played a vital role in both national and international security standard setting. The division continues its leadership role in tech nologies  and  standards  for  Cloud  Computing,  Identity  Manage ment and as a Government Wide Leader and national coordinator for the National Initiative for Cybersecurity Education (NICE). In ad dition, this year marked the publication of NIST Interagency Report (NISTIR)  7628, Guidelines for  Smart Grid Security, which identifies security requirements applicable to the Smart Grid, security-rele vant use cases, logical interface diagrams and interface categories, vulnerability classes abstracted from other relevant cyber security documents, specific issues applicable to the Smart Grid, and priva cy concerns. We also continued to provide reference specifications in multiple areas, allowing others to leverage our work to increase the security of their systems and products. tinued  to  lead,  in  conjunction  with  the  Government  of Canada's Communications Security Establishment, the Cryptographic  Module  Validation  Program  (CMVP). The Common Criteria Evaluation and Validation Scheme (CCEVS) and CMVP facilitate security testing of IT products usable by the federal government;

Information security is an integral element of good management. Information and information systems are critical assets that sup port  the  mission  of  an  organization. Protecting  them  can  be  as important  as  protecting  other  organizational  resources,  such  as money, physical assets, or employees. In order to protect their as sets, organizations need to have assurance that the security tech nologies that they invest in can work and allow interoperability, especially  in  the  area  of  cryptography,  as  well  as  management guidance.

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

| Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi   |
|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .........................................................................................................................1 | 1. Introduction .........................................................................................................................1 | 1.

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.7 (NIST 3.1.7)?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

3.1.7  General Logic Error (CWE-691)

Description

Logic errors are programming missteps that allow an application to operate incorrectly, but
usually without crashing.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”:

The main audiences for this publication are product security officers and security architects at IoT product manufacturers and those in their supply chain; cybersecurity test and evaluation experts; and other stakeholders in the IoT product market. This publication may also help customers or integrators of IoT products who are adopting IoT technologies in their residence or business, especially small business networks, as well as organizations concerned with conformity assessment of IoT products to published guidance. The first keynote was by David Barzilai, VP Sales & Marketing and Co-Founder, Karamba Security, which conducted a survey of Chief Product Security Officers (CPSOs), and their equivalents, to better understand the challenges of this role. David described the role of a CPSO and the challenges they face, especially when dealing with research and development (R&D) teams seeking to balance functionality and security in their products. He cited brand protection through maintaining consumer trust, customer service-level agreement (SLA) requirements, and regulatory compliance as the principal drivers for the creation of the CPSO role. David described a three-fold approach to improve product security and trustworthiness using standards and certifications, which he described as the 'CPSO's best friends'; tools (such as binary analysis for supply-chain security, and vulnerability management systems); and best practices (establishing the manufacturers as being responsible for and monitoring product security). He also identified the reliance on 'massive' supply chains as a huge challenge for addressing product security, noting that it is very hard for manufacturers to impose security best practices on their suppliers. He explained that using software bills of materials (SBOMs) would be very beneficial for creating transparency throughout the supply chain and allow manufacturers to more effectively monitor and address IoT product security risks.

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-07-03 Supersedes NIST SP 800-73-4 (May 2015; updated February 8, 2016) https://doi.org/10.6028/NIST.SP.800-73-4

## How to Cite this NIST Technical Series Publication:

Ferraiolo H, Mehta K, Francomacaro S, Chandramouli R, Gupta S (2024) Interfaces for Personal Identity Verification: Part 3 - PIV Client Application Programming Interface. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-73pt3-5. https://doi.org/10.6028/NIST.SP.800-73pt3-5

## Author ORCID iDs

Hildegard Ferraiolo: 0000-0002-7719-5999

Ketan Mehta: 0009-0001-1191-8656

Salvatore Francomacaro: 0009-0009-0487-2520

Ramaswamy Chandramouli: 0000-0002-7387-5858

Sarbari Gupta: 0000-0003-1101-0856

## Contact Information

piv\_comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publications is available at https://csrc.nist.gov/pubs/sp/800/73/pt3/5/final including related content, potential updates, and document history. ## All comments are subject to release under the Freedom of Information Act (FOIA). Interfaces for Personal Identity Verification: Part 3 PIV Client API

## Abstract

FIPS 201 defines the requirements and characteristics of government-wide interoperable identity credentials.

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Computer Security Division 2003 Annual Report:

interoperability  and  attendant  security  uses. The  Division  also  added public and private security practices to our Computer Security Resource Center  (CSRC)  website  (http://csrc.nist.gov), held  an  IT  Security  Capital Investment Planning Workshop, and updated Special Publication 800-38B specifying the RMAC algorithm to provide example vectors with the AES algorithm as the underlying block cipher. Many more projects and details are included in our report. During the coming year new initiatives will be completed in support of: the Healthcare Information  Portability  and  Accountability  Act (HIPAA), integrating  security  into  the  capital planning and investment control process, certification and accreditation, the Federal Information Security Management Act (FISMA) directives for Fiscal Year 2004 (FY04), extended outreach  initiatives  and  information  security training, awareness  and  education. Key  to success of the program is our ability to interact with  a  broad  constituency-federal  and  nonfederal, in order to ensure that our program is consistent with national objectives related to or impacted by information security. In  addition  to  risk  assessments  and  security plans, security  evaluation  also  plays  an  important role in the security accreditation process. It is essential that agency officials have the most complete, accurate, and trustworthy information possible on the security status of their information  systems  in  order  to  make  credible, riskbased decisions on whether to authorize operation  of  those  systems. This  information  and supporting evidence for system authorization is often  developed  during  a  detailed  security review  of  the  information  system, typically referred  to  as security certification. Security certification is the comprehensive evaluation of the  management, operational, and  technical security controls in an information system.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight provide? (Part 3)

[Assistant]
March 6, 2024. https://doi.org/10.6028/NIST.IR.8286C-upd1

## Author ORCID iDs

Stephen D. Quinn: 0000-0003-1436-684X

Nahla Ivy: 0000-0003-4741-422X

Matthew Barrett: 0000-0002-7689-427X

Gregory A.
Witte: 0000-0002-5425-1097

## Contact Information

nistir8286@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8286/c/upd1/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional details regarding the enterprise application of cybersecurity risk information; the previous documents, NISTIRs 8286A and 8286B, provided details regarding stakeholder risk direction and methods for assessing and managing cybersecurity risk in light of enterprise objectives. NISTIR 8286C describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio. This cohesive understanding supports an enterprise risk register (ERR) and enterprise risk profile (ERP) that, in turn, support the achievement of enterprise objectives.

Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

3.1.2.